PT-2019-14593 · Google+1 · Android Debug Bridge+1

Published 2019-11-26 · Updated 2020-08-24 · CVE-2019-16241

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TCL Alcatel Cingular Flip 2 version B9HUAH1

Description The issue allows PIN authentication to be bypassed on the device by creating a specific file within the /data/local/tmp/ directory. The System application responsible for the lock screen checks for the existence of this file and disables PIN authentication if it is found. This file can typically be created using Android Debug Bridge (adb) over USB.

Recommendations For version B9HUAH1, as a temporary workaround, consider restricting access to the /data/local/tmp/ directory to prevent the creation of the specific file that disables PIN authentication. Additionally, restrict the use of Android Debug Bridge (adb) over USB to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2019-16241

Affected Products

Android Debug Bridge

Tcl Alcatel Cingular Flip 2

References · 4

• 🔥 https://nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#C · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16241 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16241 · Vendor Advisory
• https://nccgroup.trust/uk/our-research/?research=Technical+advisories · Note